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Abstract — We consider perfect secret key generation for a 
"pairwise independent network" model in which every pair 
of terminals share a random binary string, with the strings 
shared by distinct terminal pairs being mutually independent. 
The terminals are then allowed to communicate interactively 
over a public noiseless channel of unlimited capacity. All the 
terminals as well as an eavesdropper observe this communication. 
The objective is to generate a perfect secret key shared by a given 
set of terminals at the largest rate possible, and concealed from 
the eavesdropper. 

First, we show how the notion of perfect omniscience plays a 
central role in characterizing perfect secret key capacity. Second, 
a multigraph representation of the underlying secrecy model 
leads us to an efficient algorithm for perfect secret key generation 
based on maximal Steiner tree packing. This algorithm attains 
capacity when all the terminals seek to share a key, and, in 
general, attains at least half the capacity. Third, when a single 
"helper" terminal assists the remaining "user" terminals in 
generating a perfect secret key, we give necessary and sufficient 
conditions for the optimality of the algorithm; also, a "weak" 
helper is shown to be sufficient for optimality. 

Index Terms - PIN model, perfect omniscience, perfect secret 
key, perfect secret key capacity, public communication, spanning 
tree packing, Steiner tree packing. 



I. Introduction 

Given a collection of terminals M. = {1, . . . , m}, suppose 
that every pair i,j of terminals, 1 < i < j < m, share 
a random binary string of length (bits), with the strings 
shared by distinct pairs of terminals being mutually inde- 
pendent. Then all the terminals are allowed to communicate 
interactively in multiple rounds over a public noiseless channel 
of unlimited capacity, with all such communication being 
observed by all the terminals. The main goal is to generate, 
for a given subset A of the terminals in M., a perfect secret 
key (SK) namely shared uniformly distributed random bits - 
of the largest size - such that these shared bits are exactly 
independent of an eavesdropper's observations of the intert- 
erminal communication. All the terminals in M. cooperate in 
generating such a perfect SK for A. 

This model for perfect SK generation, hereafter referred 
to as a "pairwise independent network" (PIN) model, is a 
specialized version of an earlier PIN model ||20l . |fl9l , fl4l . In 
the latter, every pair of terminals observe a pair of correlated 
signals (not necessarily identical as here) that are independent 
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of pairs of signals observed by all other terminal pairs. In 
03), we had studied Shannon theoretic SK generation (not 
in the perfect sense) in the asymptotic limit of large signal 
observation lengths, and its connection to the combinatorial 
problem of Steiner tree packing of a multigraph. Leading work 
on Shannon theoretic SK generation with public communica- 
tion originated in (9), iflOl . HI; see also 12 for related models. 

In contrast with JT4J, the present work bears the essence 
of "zero-error information theory," and accordingly, we rely 
on mathematical techniques of a combinatorial nature. Specif- 
ically, our emphasis here is on perfect SK generation for 
fixed signal observation lengths as well as for their asymptotic 
limits. For convenience, we shall continue to refer to our 
present model as the PIN model. This model possesses the 
appropriate structure for investigating the concept of perfect 
SK in which the generated key is exactly recoverable by every 
terminal in the secrecy seeking set A; is exactly independent of 
the eavesdropper's observations; and is uniformly distributed. 
Also, its special structure makes for a new concept of perfect 
omniscience, which plays a central role. Furthermore, in 
the spirit of fl4l . the PIN model reveals points of contact 
between perfect SK generation and the combinatorial problem 
of maximal Steiner tree packing of a multigraph. We remark 
that tree packing has been used in the context of network 
coding (see, for instance 0, ifTTl ). 

Our three main contributions described below are motivated 
by a known general connection between (not necessarily 
perfect) SK generation at the maximum rate and the minimum 
communication for (not necessarily perfect) omniscience 
El, and by the mentioned connection between the former and 
the combinatorial problem of maximal Steiner tree packing of 
a multigraph fl4l . 

First, the concept of perfect omniscience enables us to 
obtain a single-letter formula for the perfect SK capacity of the 
PIN model; moreover, this capacity is shown to be achieved 
by linear noninteractive communication, and coincides with 
the (standard) SK capacity derived in our previous work 
lfT4l . This result establishes a connection between perfect SK 
capacity and the minimum rate of communication for perfect 
omniscience, thereby particularizing to the PIN model a known 
general link between these notions sans the requirement of the 
omniscience or secrecy being perfect 0. 

Second, the PIN model can be represented by a multigraph. 
Taking advantage of this representation, we put forth an 
efficient algorithm for perfect SK generation using a maximal 
packing of Steiner trees of the multigraph. This algorithm 
involves public communication that is linear as well as nonin- 
teractive, and produces a perfect SK of length equal to the 
maximum size of such Steiner tree packing. When all the 
terminals in A4 seek to share a perfect SK, the algorithm is 
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shown to achieve perfect SK capacity. However, when only a 
subset of terminals in A C M. wish to share a perfect SK, the 
algorithm can fall short of achieving capacity; nonetheless, it 
is shown to achieve at least half of it. Additionally, we obtain 
nonasymptotic and asymptotic bounds on the size and rate of 
the best perfect SKs generated by the algorithm. These bounds 
are of independent interest from a purely graph theoretic 
viewpoint as they constitute new estimates for the maximum 
size and rate of Steiner tree packing of a given multigraph. 

Third, a special configuration of the PIN model arises 
when a lone "helper" terminal m aids the "user" terminals 
in A = A4\{m} generate a perfect SK. This model has two 
special features: firstly, (a single) terminal m possesses all the 
bit strings that are not in A; secondly, a Steiner tree for A 
is a spanning tree for either A or A4. These features enable 
us to obtain necessary and sufficient conditions for Steiner 
tree packing to achieve perfect SK capacity, as also a further 
sufficient condition that posits a "weak" role for the helper 
terminal m. 

Preliminaries and the problem formulation are in Section II. 
Our results are described in Section III and proved in Section 
IV. A discussion follows in Section V. 

II. Preliminaries 

Suppose that the terminals in M = {l,...,m}, m > 
2, observe, respectively, n independent and identically dis- 
tributed (i.i.d.) repetitions of the rvs X\, . . . , X m , denoted by 
If, . . . , X£, where X? = (x ifl , , i G M. We 

shall be concerned throughout with a PIN model X\ , . . . , X m 
ifljO, defined by each rv Jj, i G M. 1 being of the form 
Xi = (Xij, j £ A4\{i}) with m — 1 components, and the 
"reciprocal pairs" of rvs {(Xij,Xji) , 1 < i < j < m} 
being mutually independent. We assume further that X t j = 
Xji, 1 < i ^ j < m, where X^ is uniformly distributed 
over the set of all binary strings of length (bits). Thus, 
every pair of terminals is associated with a random binary 
string that is independent of all other random binary strings 
associated with all other pairs of terminals. The assumption 
is tantamount to every pair of terminals i, j sharing at the 
outset privileged and pairwise "perfect secrecy" of ey bits. 
Following their observation of the random sequences as above, 
the terminals in Ai are allowed to communicate among them- 
selves over a public noiseless channel of unlimited capacity; 
all such public communication, which maybe interactive and 
conducted in multiple rounds, is observed by all the terminals. 
A communication from a terminal, in general, can be any 
function of its observed sequence as well as all previous public 
communication. The public communication of all the terminals 
will be denoted collectively by F = F("). 

Definition 1: The communication F is termed linear 
noninteractive communication (LC) if F = (Fi,...,F m ) 
witrQ Fi = LiX", where Li is a bi x (J2jjti ne ij) ma " 
trb<0 with {0,l}-valued entries, i = l,...,m. The integer 
bi > 0, i = 1, . . . , m, represents the length (in bits) of the 

'All additions and multiplications are modulo 2. 
2 It is assumed that , i eij > 1, i = 1, . . . , m. 



communication F \ from terminal i; the overall communication 

Fhas length YT=i b i ( bits )- 

The primary goal is to generate shared perfect secret com- 
mon randomness for a given set A C M of terminals at the 
largest rate possible, with the remaining terminals (if any) 
cooperating in secrecy generation. The resulting perfect secret 
key must be accessible to every terminal in A; but it need not 
be accessible to the terminals not in A and nor does it need to 
be concealed from them. It must, of course, be kept perfectly 
secret from the eavesdropper that has access to the public 
interterminal communication F, but is otherwise passive, i.e., 
unable to tamper with this communication. 

The following basic concepts and definitions are adapted 
from O, j4j- For rvs U, V, we say that U is perfectly 
recoverable from V if Pr{U = f(V)} = 1 for some function 
f(V). With the rvs K and F representing a secret key and the 
eavesdropper's knowledge, respectively, information theoretic 
perfect secrecy entails that the security inde:x0 

s(K;F) = log \JC\ — H(K) + I(K A F) 

= log\fC\-H(K\F) = 0, (1) 

where /C is the range of K and | . | denotes cardinality. 
This requirement simultaneously renders K to be uniformly 
distributed and independent of F. 

Definition 2: Given any set A C M of size \A\ > 2, a 
rv if is a perfect secret key (SK) for the set of terminals A 
achievable with communication F, if K is perfectly recov- 
erable from (x™,F^ for each i G A and, in addition, it 
satisfies the perfect secrecy condition (Q~|). 

Definition 3: A number R is an achievable perfect SK rate 
for a set of terminals A C A4 if there exist perfect SKs K^ n > 
for A achievable with appropriate communication, such that 

— log \JC^ | — > R as n -> oo, 

n 

where KS"^ is the range of K^ n \ The largest achievable perfect 
SK rate is the perfect SK capacity C(A). 

Thus, by definition, the perfect SK capacity for A is the 
largest rate of a rv that is perfectly recoverable at each terminal 
in A from the aggregate information available to it, and is 
uniformly distributed and concealed from an eavesdropper 
with access to the public interterminal communication; it need 
not be concealed from the terminals in A c = M\A, which 
cooperate in secrecy generation. The notion of perfect SK 
capacity is more stringent than that of SK capacity under 
the requirements of the key being asymptotically recoverable 
for each i £ 4 and the security index tending to 0, both as 
n — > oo; in particular, now the security index must equal zero 
for all sufficiently large n. The latter SK capacity for the PIN 
model has been characterized in Q~2), Ifl3l , lfT4l . 

A central role is played by the notion of perfect omniscience 
which is a strict version of the concept of omniscience 
introduced in (3). This notion does not involve any secrecy 
requirements. 

3 All logarithms are to the base 2. 

4 The extra requirement of perfectness in recoverability is not a limiting 
factor for the PIN model in contrast with other models of SK generation. 
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Definition 4: The communication F is communication 
for perfect omniscience for A if (X™, . . . , X£) is perfectly 
recoverable from (X™,F) for every i £ A Further, F is 
linear noninteractive communication for perfect omniscience 
(LCO (n) (,4)) if F is an LC and satisfies the previous perfect 
recoverability condition. The minimum length (in bits) of an 
LCO (n) (A), i.e., min LCO (») (A) T,T=i b i' wil1 be denoted by 
hCO^(A). The minimum rate of LCO (n) (yl) is OMN(A) = 
limsup„iLC0W(A). 

III. Results 

A. Perfect SK Capacity for the PIN Model 

Our first main contribution is a (single-letter) characteri- 
zation of the perfect SK capacity for the PIN model, which 
brings forth a connection with the minimum rate of commu- 
nication for perfect omniscience. 

Theorem 1: The perfect SK capacity for a set of terminals 
ACMis 

C(A) = e y - OMN(A) (2) 

where 

in 

OMN(A) = min V R i: (3) 

(i?i,...,ii m ) g n(A) ^ 

2 — 1 

with 
11(A) = 

(R u ...,R m ) £ K m : Ri>0, i = l,...,m, ^ 

J2i£B — El<i<j<m. i£B, jEB e y'' (• (4) 

Furthermore, this perfect SK capacity can be achieved with 
linear noninteractive communication. 

Remarks: (i) Clearly, the perfect SK capacity, by definition, 
cannot exceed the (standard) SK capacity studied in lfT2l . fl4l . 
Indeed, Theorem 1 implies that the latter is attained by a 
perfect SK. 

(ii) In the same vein, the minimum rate of communication 
for (asymptotic) omniscience (3] can be attained for the PIN 
model with perfect recoverability at A of (X™, . . . , X%) for all 
n sufficiently large, and with linear noninteractive communica- 
tion. We mention that noninteractive communication, without 
a claim of linearity, was shown to suffice for (asymptotic) 
omniscience in (3). 

B. Maximal Steiner Tree Packing and Perfect SK Generation 

Theorem 1 serves to establish the sufficiency of an LC 
in achieving perfect SK capacity through the intermediate 
attainment of perfect omniscience for A, as seen in its proof 
below. However, as also evident from the proof, decoding is 
by exhaustive search of prohibitive complexity. 

The PIN model can be represented by a multigraph. This 
representation leads us to an efficient algorithm for perfect 
SK generation, not necessarily through perfect omniscience, 
by a maximal packing of Steiner trees of the multigraph. 



In particular, this algorithm will be seen to entail public 
communication in the form of an LC. On the other hand, 
such an algorithm based on maximal Steiner tree packing need 
not attain perfect SK capacity. The size of the largest perfect 
SK that is thus generated can be estimated in terms of the 
minimum length of an LCO (n) (A). 

Definition 5: A multigraph G = (V,E) with vertex set 
V and edge set £ is a connected undirected graph with no 
selfloops and with multiple edges possible between any pair 
of vertices. Given G = (V, E) and a positive integer n, let 
£?(") = (V,E( n n denote the multigraph with vertex set V 
and edge set E^ n ' wherein every vertex pair is connected by 
n times as many edges as in E; in particular, G^ 1 ' = G. 
Furthermore, will denote the total number of edges in 

£)(«). 

To the PIN model X\ , . . . , X m (cf. section II), we can 
associate a multigraph G = (Ai, E) with M. = {1, . . . , m} 
and the number of edges connecting a vertex pair (i, j) in E 
equal to e^; in particular, the edge connecting (i, j) will be 
associated with the random binary string Xij . 

By this association, it will be convenient to represent (0 
and © as 

in 

OMN G (A) = min V R u (5) 

{R u ...,R m ) e n G (A) ^ 

1 = 1 

with 

n G (A) - 

r (i?i,...,i? m ) £ M m : Ri >0, i = l,...,m, ^ 

\ J2i£B — El<i<3<m, iEB, j£B e ih ( ) (6) 

whereupon © can be restated as 

C(A) = \E\ - OMN G {A). (7) 
Furthermore, it is easy and useful to note that for every n > 1, 

OMN GM (A) = nOMNa(A). (8) 

Definition 6: For A C V, a Steiner tree (for A) of G = 
(V, E) is a subgraph of G that is a tree, i.e., containing no 
cycle, and whose vertex set contains A; such a Steiner tree is 
said to cover A. A Steiner tree packing of G is any collection 
of edge-disjoint Steiner trees of G. Let p(A, G) denote the 
maximum size of such a packing (cf. fl5l), i.e., the maximum 
number of trees in the packing. The maximum ratJ^ of Steiner 
tree packing of G is limsup,^^ -^^{A, G^). When A = V, 
a Steiner tree becomes a spanning tree, with corresponding 
notions of spanning tree packing, maximum size and rate. 

Given a PIN model, the notion of Steiner tree packing of 
the associated multigraph leads to an efficient algorithm for 
constructing an LCO^ n '(A) and thereby generating a perfect 
SK. The next Theorem 2 indicates that the largest size of 
a perfect SK that the algorithm generates is the maximum 
size of the Steiner tree packing. Furthermore, Theorem 2 
and its corollary, and Theorem 5 provide nonasymptotic and 
asymptotic bounds on the size and rate, respectively, of the 

5 In fact, linin-joo ^fi(A, G^™') exists, as shown later in Proposition 4. 
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best perfect SKs generated by the algorithm. Of independent 
interest from a purely graph theoretic viewpoint, these results 
also constitute new bounds for the maximum size and rate of 
Steiner tree packing of a given multigraph. 

Theorem 2: For the multigraph G = (M , E) associated 
with a PIN model and for A C M., it holds for every n > 1 
that 

(i) the terminals in Ai can devise an LCO^ (A) of total 
length n\E^\ — p,(A,G^) and subsequently generate a 
perfect SK with log|/C>)| = fx{A, G^); 

(ii) MAG (n) ) < n\EM\-LCO%\A); (9) 

(in) furthermore, LCO^ (A) is bounded below by the value 
of an integer linear program according to 

LCO£XA) > INT G (n) (A) 

where 



H f (A, G), is fi f (A, G) = max TG(A) £* =1 T h 

Remarks: (i) Clearly, /if(A,G) corresponds to a linear 
program with finite optimum value, and the maximum is 
attained. Furthermore, it is readily verified that for every 

n > 1, 

Vf(A,G^) = n/if(A,G). (14) 

(ii) We observe that in Definition 6, G) = 

max T G (A)nz fc J2i=i T i- 

Proposition 4: For a multigraph G = (Ai, E) and A C Ai, 
it holds that the maximum rate of Steiner tree packing (for A) 
of G satisfies 

limsup-M(A = liminf- M (A,G (n) ) 

n->oo n n->oo n 

lim -fi(A,G (n) ) 



n—¥oo Ji 

fi f (A,G). 



(15) 



INT GM (A) 



with 

l Gln) (A) 



(h,...,i m ) e z G(n ,(A) 



i= 1 



Ii 



(10) 



(h,...,I m ) e Z m : 7i>0, i = l,...,m, 

J2i£B Ii — n El<i<]<m, ieB. j£B e 'j' } ■ (11) 



Theorem 5: For the multigraph G = (A4,E) associated 
with the PIN model and for A C M., it holds that 



\c{A) < lim -pL(A, G {n) ) < C(A). 



Furthermore, when A = M., 
1 



lim -n(M,G M ) = C(M). 

n—t-oo fi 



(16) 



(17) 



Corollary 3: For every n > 1, the maximum size of Steiner 
tree packing of a multigraph G'™' satisfies 



n(A,G (n) ) < n \EV>\-INT GM (A), 



(12) 



with equality when A = Ai. 

Remarks: (i) Note that the bounds in Theorem 2 are 
nonasymptotic, i.e., valid for every n. Also, note in the bound 
in Theorem 2 (ii) for fj,(A,G^) that LCO^ } (A) is defined 
in terms of its operational significance. 

(ii) Further, Theorem 2 provides a nonasymptotic 
computable lower bound for LCO^(A) in terms of an 
integer linear program. The optimum value of its linear 
programming relaxation constitutes a further lower bound 
which equals OMN GM (A) = nOMN G (A), by ©. 

Next, we turn to connections between perfect SK capacity 
C(A) and the maximum rate of Steiner tree packing of G = 
(A4,E). The following concept of "fractional" Steiner tree 
packing will be relevant. 

For A C Ai = {l,...,m}, consider the collection 
{Si, . . . , Sk} of all distinct Steiner trees (for A) of G, where 
k = k(G). Consider the region 

T G (A) = 

pfe 



(T!,...,T k ) e 



Ti > 0, l = l,...,k, 



V(i,j), 1 < i < j < m 



(13) 



Definition 7: For a multigraph G = (M,E) and A C A^, 
the maximal "fractional" Steiner tree packing of G, denoted 



Remark: For the PIN model with m terminals, every 
Steiner tree has at most m — 1 edges. Also, from dToT i. 
H(A, G (n) ) < nG(vl) for all large n. Hence, the overall 
complexity of the perfect SK generation algorithm based on 
Steiner tree packing is linear (in n). 

The upper bound on liirin^oo —p,(A, G^) in Theorem 5 is 
not tight, in general, as seen by the following example. 

Example: Consider the multigraph [7] in Figure 1 with 
\M\ = 7 and \A\ = 4; the terminals in A are repre- 
sented by the solid circles and every shown edge is single. 
Computations give that C(A) = 2.0 by (0, while 
lirrin^oo —fj,(G^ n ', A) = 1.8 by Proposition 4 and the scheme 
in Lemma 1. 




Figure 1: Example 

C. The Single Helper Case 

As observed after Theorem 5, the maximum rate of Steiner 
tree packing can fail to achieve perfect SK capacity. A natural 
question that remains open is whether the maximum rate of 
Steiner tree packing equals perfect SK capacity for the special 
case of the PIN model in which a lone "helper" terminal m 
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assists the "user" terminals irij4 = {l,...,m— 1} generate a 
perfect SK. In this section, we provide partial answers. 

First, we derive necessary and sufficient conditions for 
the maximum rate of Steiner tree packing to equal perfect 
SK capacity in ( [ToT l and, analogously, the (nonasymptotic) 
maximum size of Steiner tree packing to meet its upper bound 
in ([T2l i. These conditions entail the notion of a fractional 
multigraph. Throughout this section, we shall assume that 
A = {1, . . . , to - 1} C M = {1, . . . , to}. 

Definition 8: Given a multigraph G = (Ai,E) as in 
Definition 5, a fractional multigraph G — (A, E) in A (with 
vertex set A) has edge set E = {e.^ 6 K, < < e^, 1 < 
i < j < to— 1}. For any such G, the complementary fractional 
multigraph G\G = (A4, E\E) has vertex set .M and edge set 
E\E = {eij — iij, 1 < i < j < m— 1; ej m , 1 < i < to— 1}. 
The definitions of TZ G (A) in ©, OA/7V G (A) in ©, 7^(A) in 
( fT3] l and i-if(A, G) in Definition 7 all have obvious extensions 
to G and G\G as well. Further, (O and also hold for G 
and G\G. 

Proposition 6: For the multigraph G = (M , E) associated 
with the PIN model, the following hold: 
(i) 

Hf(A, G) > max /x / (A, G) + fx f (M,G\G); 

G 

(ii) 

OMNq(A) < mmOMN 6 (A) + OMN G ^ e (M); 

G 

(iii) 

p(A,G) > max^(A,G 7 ) + //(M,G\G/); 

(iv) 

where the optima in (i) and (ii) are over all fractional 
multigraphs G = (A, E) in A, and the optima in (iii) and 
(iv) are over all multigraphs G/ = (A,E) in A for which E 
consists of only integer-valued e^s. 

Theorem 7: For the multigraph G = (A4,E) associated 
with the PIN model, 

® 1 

lim -n(A,G {n) ) = C(A) (18) 

n— >-oo n 

iff 

OMNg(A) = min OMNMA) + OMN G , MM), (19) 
G x 

where the minimum is over all fractional multigraphs G = 
(A, E) in A; 
(ii) 

M(A,G (n) ) = \E\-INT G {A) 

iff 

INT G (A) = min INT Gj (A) + INT G ^ Gi (M ) , (20) 

Gi 

where the minimum is over all multigraphs G/ = (A, E) for 



which E consists of only integer-valued e^s. 

Our final result provides another sufficient condition for the 
maximum rate of Steiner tree packing to equal perfect SK 
capacity. Recall from Theorem 1 that, in general, perfect SK 
capacity for A can be attained with public communication that 
corresponds to the minimum communication for perfect omni- 
science. If the latter can be accomplished with the sole helper 
terminal m communicating "sparingly," then it transpires that 
maximal Steiner tree packing attains the best perfect SK rate. 
An analogous nonasymptotic version of this claim also holds. 
Heuristically, a sufficient "weak" role of the helper terminal m 
turns the Steiner tree packing of A, in effect, into a spanning 
tree packing of A. 

Let di = e ij denote the degree of vertex i, i e M. 

Clearly, any (Rl , . . . , R^) (resp. (I* , . . . , 1^)) that attains 
the minimum corresponding to OMNg(A) (cf. dU) (resp. 
INT G {A) (cf. (dOll)) must satisfy R* < d t (resp. /* < di), 
i = 1, . . . , m. 

Theorem 8: For the multigraph G = (A4,E) associated 
with the PIN model, 

(i) if there exists (R{, . . . , R* m ) that attains OMN G (A) (cf 
0) with R* n <d m /2, then 

lim -p,{A,G^) = C(A) = \E\-OMN G (A). 

n— >oo ft 

(ii) ;/ there exists (/*, . . . , 1^) that attains INT G (A) (cf. 
HM) with I* m < [d m /2\, then 

fi{A,G) = \E\-INT G (A). 



IV. Proofs 

Proof of Theorem 1: From remark (i) following Theorem 
1, we need prove only the achievability part. The main step 
is to show, using a random coding argument, the existence 
with large probability of an LCO'™' (A) of small length under 
appropriate conditions; the terminals in A then extract from the 
corresponding perfect omniscience a perfect SK of optimum 
rate. 

Let = (X{\...,x£) take values in Xfo = X[ l x 

. . . x A™, where X? = {0, ™ e «. We denote a real- 
ization of by x n M = (.t™, . . . , i^). Fix b\, ... , b m . Let 
L = (Li, ... , L m ) consist of mutually independent random 
matrices of appropriate dimensions as in Definition 1. Fur- 
thermore, the rv Li consists of i.i.d. equiprobable components, 
i=l,..., to. Clearly, Li, . . . , L m makes for a random LC. 

Since for Li , . . . , L TO to constitute an LCO'™' (A), it suffices 
that the mapping 

%m ~* {%i i Lii™, . . . , L m x^) 
be one-to-one for every i £ A, we have 
Pr{ L does not constitute an LCO (,l) (A) } 
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Pr 



3 



^Xm^Vm^Xm satisfying 
= f° r some j £ A such that 

m 



Ljxp = Ljj/™ for each i = 1, 

3 x^, ^06 A^ satisfying 
Pr ■( x™ = for some j £ A such that 
for each i = 1, . . . , m 

AT, satisfying 



j 

L;,r 



(21) 



< 



B^A 



^ Vj € B, and £!? = Vj 6 B c 
such that L,£™ = 
for each i = 1, . . . , m 



(22) 



where (|2TT > is by the linearity of the communication and 
is obtained by applying the union bound to the event in (f2TT >. 

Now, we note by the assumed independence of Li, . . . L m 
and the fact that the components of L; are i.i.d. and equiprob- 
able, i = 1, . . . , m, that for each nonempty B ^ A, and any 



1 M 



satisfying x 1 } ^ Vj £ B, and x™ = V j £ B c 



have 



Pr{LiX™ = for every i = 1, . . . , m} 

= Pr{Lix" = for every i £ B} 



(23) 



Continuing with (|22[) upon using (|23[) . we obtain 
Pr{ L does not constitute an LCO (n) (A) } 



< 



E 



^ 6 : x] ? 

Vj G B, x" = Vj £ B c 



2-E ieB b * 



< 2"(E,i= e b e "=)2~ E 



73^0, 



E 2 "" ( - 



eife) 



(24) 



73^0, 
B^A 



We note that in this proof, the special structure of the PIN 
model is used for the first time in the second inequality above. 

Now, let . . . , i?^) achieve the minimum in the right- 
side of (0). Pick an arbitrary e > and choose bi in (|24|) 
as bi = \n(R* + e)], i = 1,. . .,m. Then, by the definition 
of 1Z(A), the right side of ( f24b decays to zero exponentially 
rapidly in n; in particular, we get from that for all n sufficiently 
large, L constitutes an LCO^ n \A) with large probability. This 
implies the existence of a (deterministic) L = (Li, . . . , L m ) 
that constitutes an LCO^ (A) for all n sufficiently large. 

It remains to extract a perfect SK from the perfect omni- 
science obtained above. By the definition of the PIN model, 
observe that 



Pr{X n M 



} = 2-E, fc ne ' k for all Z n M £ X^ 



By the linearity of the LCO^(A) above, it is readily seen 
that 

the cardinality \{x% t £ XV\ : Liif = eij, i = 1, . . . , m}\ is 



the same for all feasible (a\ 
1, 



,) where a % £ {0, 1}' 



to, and that this common number is at least 

TV = 2(E.fc nei k )-(j2T=i b 0. 



For each communication message (a l7 . . . , a TO ), we index the 
elements of the coset {x^ : Li£" = a i7 i = 1,...,to} 
in a fixed manner. Then, for a realization x n M £ XJ^, every 
terminal in A (which knows xfl^ by omniscience) picks as 
the perfect SK the index of in its coset, as in lfl8l . Since 
Xj^ takes values in XJ^ and since each coset has the same 
size, it follows that this random index is uniformly distributed 
and independent of the coset (the communication message), 
thereby constituting a perfect SK. Lastly, the rate of this 
perfect SK is at least 

rn 

lim - log N = V" e [k - R* - me 



l.k 



i=l 



= eik - OMN(A) - me, 



l.k 



where e > is arbitrary. 



Proof of Theorem 2: The proof will rely on the technical 
Lemma 1 which is stated next and established in Appendix A. 

Lemma 1: Let G = (V, T) be a tree, and associate 
with each edge a bit. Then the terminals in V can devise 
a (noninteractive) LC of length \T\ — 1 bits enabling every 
terminal in V to recover all the edges ofT, i.e., all the bits 
associated with the edges of T. 

(i,ii) If /i(4,(?W) = k, say, then E^ n ' is the disjoint union 
of k Steiner trees Ti,. . . ,Tfc (each of which covers A) and 
the remaining edge set R, so that 



LE (1) I 



k 



T,\ 



\R\ 



(25) 



where |Tj| denote the number of edges in Tj. 

Apply Lemma 1 to every Steiner tree T i: i = 1, . . . , k, in 
( |25| > to get k LCs that enable every terminal in A to recover the 
edges of all the Tj, i = 1, . . . , k. An additional communication 
of \R\ bits will lead to the recovery of the leftover edges in 
R. Thus, there exists an LCO (n) (A) of length 



k 

E 



TA - k + \R\ = n\E {1) \ - k (bits), 



which establishes the first assertion of (i); also, clearly, 
LCO$(A) < n\E { ^ \ - k, thereby proving (ii). To establish 
the second assertion of (i), it remains to extract a perfect SK 
from the perfect omniscience obtained using the LCO (,l) (A) 
above of total length n\E^\ - fj,(A,G^) (bits). This is 
accomplished exactly as in the proof of Theorem 1 , whereby 
the terminals in A extract a perfect SK K^ n ' with log \10- n > \ = 

(iii) Consider an LCO^ n ^(A) = (Li, . . . , L rn ) achieving 
LCO^(A) with (b 1 ,...,b m ) (bits), respectively. Fix B C 



M, B j& A, and consider S = {x n M 
B c } with cardinality 2 n ^ 1 <^< m - ^ E 



3 



= for every j £ 
eij . For every k £ 
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B c tlA and every x"^ G S, it holds that x^ = 0. Consequently, 
by the perfect recoverability property of an LCO^ (A), such a 
terminal k must be able to discern all the sequences in S using 
only (Li, . . . , i m ). Note also that for every ai'L G 5 and every 
i G £? c , it follows that = 0; therefore, the set of all 

communication messages corresponding to S has cardinality 
at most 2^*e B bi . From the mentioned condition on perfect 
recoverability at terminal k £ B c P\ A of all sequences in S, it 
must hold that 2^-e-e bi > 2™^i<-<i<™ 1 i-j)^ e «. Since this 
argument is valid for every B C A4, B ^ A, we have that 
6 m ) G I G (n)(A) and, hence, LCO^(A) is at least 
niin (/li ...,/ m ) e i G(ji) (A) J2T=i I i- ■ 

Proof of Corollary 3: The inequality in the Corollary 3 is 
immediate from (O and ( TTTb . Equality when A = M. relies on 
Lemma 2 and 3 below; Lemma 2 is a classic result of Nash- 
Williams ifTTl and Tutte lfl6l on the maximal size of spanning 
tree packing of a multigraph, and Lemma 3 (3) provides an 
upper bound for (standard) SK capacity 

Lemma 2: 477V . 4761/ For a multigraph G = (M,E), 
1 



mm - — ; 

v \V\-l 



{e G E : e crosses V} 



where the minimum is over all partitions V of A4. 

Lemma 3: R3] For the multigraph G = (A4,E) associated 
with the PIN model and for A C M., 



C(A) = \E\ 



mm - — - 

v \V\ 



1 



min y Ri < 

,R m ) e Ha(A) ^ 



{e G E : e crosses V}\, 



where the minimum is over all partitions V of M such that 
each atom ofV intersects A . 

By © and (HQ, K G (n)(M) D T G ^{M) with G ( "> and 
A4 in the roles of G and A in (O, it is clear that 



(Ri 



mm 

,R m ) e n G{n) (M) 



Ri 



< 



i = 1 
m 

min > 

j m ) e i Gin) (M) f^ x 



(26) 



noting that the value on the right-side above is an integer. 
Then the claimed equality follows since 

fi{M 7 G^) 



< 



< 



< 



n \E™\ 



mm - — - 

v V 



(ii, 



(Ri 



min } I{ 

,i m ) 6 i G( „)(A4) f^ x 



min } Ri 

..,R m ) e n aM (M) 

{e G i? (n) : e crosses V} 



Proof of Proposition 4: By remark (ii) after Definition 7 
in section III, we have that 



i 

— max 



E T < 

7S" J (A)nZ» , =1 

A; 



max > TJ . 

r G (A)niz* ^ 



Since 



lim max > TJ 
the assertion follows. ■ 



^??\E r ' = MAG), 



Proof of Theorem 5: The second inequality of the theorem 
is immediate by Theorem 2 (i) and the definition of C(A). 

The proof of the first inequality takes recourse to the 
following result. 

Lemma 4: j^j, j^j/ For a multigraph G = (A4 , E) that is 
Eulerian^ and A C M., 



p(A,G) > 



— mm 

2 ccM-.CnAytV) 



{e G £ 



e crosses 



C, C c } 



Now, for every n, lZ G ( n ) (A) D I G < n ) (A), and so 



Eli > min > i?i 



By Lemma 3, 

n\E^ 



< min- — ; {e G E {n > : e crosses V\ 

~ v \V - 1 \ x 1 



< mm 

CCM:CnA^H 



{e G fiW : e crosses C, C* c } 



(28) 



Restricting ourselves to n even, note that (?W is Eulerian, 
i.e., each vertex has even degree. Then since the term within 
J in the right side in Lemma 4 is clearly an integer, we have 
that 

> - min ||e G i? (n) : e crosses C,C C } 

2 $^CdM-.cr\A^$ I 



1 

> - 
~ 2 

1 

2 



2 n 



K G(n) (A) 

n\E^\-OMN G(n) (A)\ 
\E^\ -OMNg(A)] , by ® 



by 028 



by 026|) 

(27) thereby establishing the left inequality of the theorem. 



= ^nC(A), 



= f i(M,G M 
where d27] i is by Lemma 3. ■ 



by Lemma 2, 



Proof of Proposition 6: We prove (i) and (ii). The proofs 
of (iii) and (iv) are similar but simpler, and are omitted. 

6 The number of edges incident on each vertex is even. 
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(i) Similarly as in remark (i) following Definition 7, we note 
that the right-side of (i) corresponds to a linear program with 
finite optimum value, and the maximum is attained. Let G*, 
(7\*, . . . , T* ± ), (Tf, . . . , T**) attain the maximum in the right 
side of (i), where (T{,..., TQ and (7?*, . . . , Tg) attain the 
respective maxima in /j,f{A,G*) and fif{M,G\G*), with ki 
(resp. fe) being the number of all distinct spanning trees in 
A (resp. M) of G. Clearly, (T* , . . . , T fc * , I?* , . . . , T£) is 
feasible for [if (A, G), noting that a Steiner tree for A of G is 
either a spanning tree in A or a spanning tree in M.. 

(ii) Similarly as in the proof of (i), we let G* 
{Rl, . . . , R^-i), {Rt*, ■••■> -Rm ) attain the minimum in the 
right side of (ii), where {Rt,..., R* m -i) and {Rl*, ...,R%) 
attain the respective minima in OMN G , {A) and 
OMN g \q» {M). Clearly, {Rt+Rt*, R* m _i+R%_i, R%) 
is feasible for OMNg{A), thereby proving (ii). 

Similar arguments considering the corresponding integer 
linear programs lead to (iii) and (iv). ■ 

Proof of Theorem 7: We shall prove only (i); the proof of 
(ii) is similar and is omitted. 

First, we show that $19[ implies (1 1 8t . i.e., 

lim -n(A, G {n) ) > C{A) = \E\ - OMN G {A), (29) 

(since the reverse inequality always hold by Theorem 5). Let 
a fractional multigraph G* = {A,E*) achieve the minimum 
in the right side of ( fT9b . Then, 

lim -n{A,G {n) ) = Uf{A,G), by O 

n— foo n 

> max n f {A,G) + n f {M,G\G), 

G 

by Proposition 6 (i) 

> fif{A, G*) + fj,f{M,G\G*). (30) 

Next, because the linear program in the right side of dT9l 
involves a cost and linear constraints with only integer-valued 
coefficients, G* — {A, E*) can always be taken to be rational, 
i.e., all e*„ s in E* are rational. Next, let I be the least common 
multiple of all e*jS so that £?*w = {A,E*( l >) is a multigraph 
with edge set E*"> = {/ g*^, 1 < i < j < m — 1}. Then, 

HM,&) = jHf{A,G*W), byd 

= ±(\E*®\-OMN d . m (A)) 

= \E*\-OMN G ,{A), by®; (31) 

the second equality is by Proposition 4 and the second 
assertion of Theorem 5 noting that the vertex set of G*^ 
is A. By a similar argument, we have that 

fj, f {M,G\G*) = \E\E*\ - OMN GXG ,{M). (32) 

Substituting (ED and (OS in d30l l. 

lim^I^G^) 

> \E*\ + \E\E*\ 

~{OMN G ,{A) + OMN G \ G ,{M)) 
= \E\-OMN G {A), by 



thereby giving ( 1291 ). 

Conversely, to prove that ( TT~8b implies ( TT9l , i.e., 

OMN G {A) > minOMN G {A) + OAIN GXG (M) 

G 

(since the reverse inequality always holds by Proposition 6 
(ii)), we can assume similarly as above that (x / {A, G) is 
attained by {T* , . . . , T£) with rational components, where 
k = k(G) is the number of distinct Steiner trees (for A) of 
G (see passage preceding (fT3l). Next, since A = {1, . . . , m — 
1} C M, the collection of all distinct Steiner trees of (for A) 
of G, namely {Si, . . . , Sk} can be decomposed as Si U <S 2 > 
where Si (resp. £2) comprises all spanning trees in A (resp. 
Ai). Consider the fractional multigraph in A defined by 

d* = {A, E*), ~E* = {I*, = Y, T i*^<'<j< 

Then, it follows that 

(x f {A,G) = fif{A,G*) + i* f {M,G\5*) (33) 

since 

k 

N {A,G) = J2 T * 
1=1 

= E T i+ E T * 

l: S1ES1 I: S1ES2 

< fx f {A,d*) + f, f {A,G\d*), 

by the definition of [if, the reverse inequality is always true. 
Finally, the right side of (TT~8T > satisfies 

OMN G , [A) + OMN GXG , (M) 

< OMN G M)+OMN GXG ,{M) 

= (\E*\- H (A,d*)) + 

(\E\E*\-n f (M,G\d*)), 
as in CD}, J32j| 
= \E\ - fif{A, G), by d33j 
= OMN G {A), 

by (US), (EJ and ©. ■ 

Proof of Theorem 8: First, we prove (ii), and then (i) by 
applying (ii) to G^ = (AijE^) and taking appropriate 
limits. 

The proof of (ii) entails considering a modification of G = 
(A4 , E) obtained by "edge-splitting" at the helper vertex m. 
Specifically, if G has more than one vertex in A connecting 
to 771, then for any two such vertices u,v £ A, let G uv = 
(A4, E uv ) denote the multigraph obtained from G by splitting 
off the edges {u, m) and {v, m), i.e., by reducing e um and e vm 
each by unity and increasing e uv by unity; note that \E UV \ = 
\E\-1. 

The following claim, whose proof is relegated to Appendix 
B, will be used to establish the theorem. 
Claim: For a multigraph G = {M.,E), 
(a) if m is connected to at most one vertex in A or if there 
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exists (I*,... ,I* n ) attaining INT G (A) with I* n = 0, then (with I fixed), we obtain (i) 
fx(A, G) = \E\ — INT G (A); (34) 



(b) if m is connected to more than one vertex in A 
and if there exists (I*,..., l^J attaining INTq(A) with 
< Im < [d rn /2\, then for u 6 A connecting to m there 
exists v = v(u) £ A, v ^ u, also connecting to m, such that 
(/*,...,, IJn-iJm - !) attains INT G ™ (A), and so 



\E\ - INTg(A) = \E UV \ - INT G uv{A); 



(35) 



(c) if m is connected to more than one vertex in A, then 
for u,v £ A both connecting to m, 

fi(A,G)>fx(A,G uv ). 



In order to prove (ii), we observe first that it holds if the 
hypothesis of Claim (a) is met. It remains to consider the realm 
of Claim (b). Let (JJ, . . .,/,*„) be as in Claim (b). Then we 
obtain G2 = (M., E2) = G uv for some u, v G A connecting to 
m, and with (I* , . . . , I* n - 1) attaining INT G2 (A). If /*„ - 1 = 
or m connects to at most one vertex in A in G2, then by 

(EH* 03, 

fi(A,G 2 ) = \E 2 \-INT G2 (A) = \E\-INT G (A). 

Else, G2 = {M., E 2 ) is back in the realm of Claim (b), noting 
that the degree of m in G 2 is d m ~2 and 1 < \_(d m -2)/2\ 
as 2 <i; n < [d m /2\. 

Thus, we obtain a finite number of multigraphs G\ = 

G,G 2 ,...,G q , such that G l = (M,E t ) = G™ 1 for some 
(u, v) = (u,v)(i) in A, and satisfying 

-INT Gi _M) = \Ei\-INT Gi (A), i = 2,... )9 

(36) 

and 

/i(A,G,) = | J B 9 |-/iVr Gg (A). (37) 

Using Claim (c) repeatedly, 

fi(A,G) = n(A,G!) > n(A,G q ) 

= \E q \-INT Gq (A). by d37j 

= \E\-INT G (A) (38) 

Then, (ii) is immediate from 



by the repeated use of 1 
and Corollary 3. 

To establish (i), the hypothesis implies (with a slight abuse 
of notation) that 

m 

min V Ri = OMNMA). (39) 

n G (A)C\{R m <d m /2} f^ x 

Pick (Rl, . . . , R* n ) that attains the left side with all rational 
components, and let / be the least common multiple of their de- 
nominators. Thus, for every integer n > 1, (nlR\ : . . . , nlR*^ 
attains INT G ( n i)(A). As rdR* m < nl^, it follows from (ii) 
that 

(j(4,GW) = nl\E\-INT &n i)(A) 

= nl\E\-nlOMN G (A), by p9]). 

Upon dividing both sides by nl and taking limits as n — > 00 



V. Discussion 

We conclude by mentioning several unresolved questions 
raised by this work. 

When all the terminals in M. see to share a perfect SK, 
i.e., A = M., we see from Theorem 5 that maximal spanning 
tree packing attains perfect SK capacity; this is no longer true, 
in general, when A C Ai (cf. the example in section III.B). 
However, the single helper model in section III.C possesses 
the special feature that a Steiner tree for A is a spanning tree 
for either A or M.. In spite of this, it is unresolved whether a 
maximal Steiner tree packing of A attains perfect SK capacity 
(i.e., if the second inequality in ( TToT l is tight) or if (fT2l holds 
with equality (whereupon the sufficient conditions of Theorem 
8 become superfluous). We note that the optimality of maximal 
spanning tree packing in (fT2l and d!71 l. constitutes, in effect, 
a reformulation of the classic graph-theoretic results of Nash- 
Williams [111 and Tutte |[T6l . A better information theoretic 
understanding of (fT2l and (fTTT i is desirable, and might suggest 
alternative interpretations of related results in combinatorial 
tree packing. 

Perfect SK capacity in Theorem 1 was shown to be achiev- 
able by way of the attainment of perfect omniscience at 
a minimum communication rate OMN(A). However, when 
A = M, Theorem 5 asserts that maximal spanning tree 
packing attains capacity; an examination of its proof (cf. 
Lemma 1) shows the corresponding rate of communication 
to be (m - l)G(A-l) which can be less than OMN(M). 
It remains open to characterize the minimum rate of public 
communication needed to attain perfect SK capacity. 

Maximal Steiner tree packing is guaranteed by Theorem 5 
to attain a fraction of at least half of the capacity C(A). What 
is the best feasible value of this fraction? 

Lastly, the design of efficient algorithm for perfect SK 
generation is largely unexplored. 



Appendix A: Proof of Lemma 1 

We prove a slightly stronger result that there exists an LC 
whose null space comprises only the all-zero and the all-one 
strings (corresponding to the edges in T being labelled all 
zero or all one) which clearly enables every terminal in V to 
recover all the edges of T. We prove the claim by induction. 
When |T| = 2, say, with T = {e\ = (vi,t>2),e2 = (W27W3)}, 
then ei + e 2 mod 2 constitutes an LC whose null space is 
{(00), (11)}. Next, suppose the claim is true for all trees 
with k — 1 edges, k > 3. Given a tree with k edges, 
pick an end vertex Vk+i of the tree (a vertex with degree 
one), and let Vk be the sole vertex connecting to Vk+i- Then 
G = (V,rU{(«fc,«fc+i)}). and G' = (V\{v k+1 },V) is a 
subtree of G. By the induction hypothesis, there exists an LC 
for G', say, F(T') of length k — 2 (bits) and whose null space 
is {0 fc-1 ,l fe-1 }. Let Vk-i be another vertex connecting to 
v k and let e fc _i = (v k -i,v k ) and e k = (v k ,v k+1 ). Then, 
consider {F(T'), e k -i + e k } as an LC of G of length k — 1. 
It is now clear that the null space of this LC is {0 k , l k }. ■ 
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Appendix B: Proof of Claim in (the proof of) 
Theorem 8 

(a) Let Ga = (A, Ea) denote a subgraph of G in A, where 
Ea C E consists only of those edges in E whose both end 
vertices lie in A. Clearly, 

\E\-INT G {A) > /x(A,G) > n(A,G A ) 

= \e a \-int Ga (A), 

by Corollary 3 with M = A 

= \E\-(d m +INT GA (A)). 

Thus, it suffices to show that 



INTq a (A) < INTc(A). 



(B-l) 



Consider first the case where (/^ , . . . , 0) attains 

INT G (A). Without loss of generality, let {l,...,a}, a < 
m — 1, be the set of vertices in A connecting to to. For any 
v G {1, . . . , a}, since {v, m} ^ A, we have that I* + I* n = 

u — 1 e n™< 



ly > e vm (see (dU). Consequently, since d 



we see that (ij - e lm , e am , . . . , I^-i), with 

components summing to INT G (A) — d m is feasible for 
INTq a (A). Thus, INT G {A) - d m > INT Ga (A), establish- 
ing dB-U . A nearly identical argument would show that (IB-U 
holds too for the case when at most vertex 1 is connected to 
to, and is omitted. 

(b) Consider any G uv — (M,E UV ) as in the second 
paragraph of the proof of Theorem 8, and let (/**, . . . , I™) 
attain INT G ^ (A). Then, (/**, . . . , I^J** + 1) is feasible 
for INT G (A), so that 



INTc(A) < INT G mv (A) + 1. 



(B-2) 



Without loss of generality, let {1, . . . , a} be as in the proof of 
Claim (a). To prove Claim (b), it suffices to show for u = 1 
that there exists v G {2, . . . , a} such that (/j*, . . . , — 
1) is feasible for INT G i,{A) if < /,*„ < [^\. This would 
mean that 

INT G (A) — 1 > INT G iv(A). (B-3) 

which, together with the observation that \E\ — 1 = li? 1 "!, 
establishes Claim (b). To this end, referring to ( fTTT i. for B C 
M, set 



(B-4) 



(B-5) 



e G (B)= E e «< e c(0)=O, 

l<i<j<m, i£B, jeB 

and let 

B, Q^BcM, B^A, 

We make the following 

Claim (d): For u = 1, there exists v G {2,..., a} 
connecting to m with the properties that 

a) for B G B such that 1 ^ B, to G B, it holds that v G B; 

b) for B G B such that 1 G B, to ^ B, it holds that v £ B. 
Then, with the choice of v as in the Claim (d), a simple 

check of all the possibilities for B (in B or in B c ) that are 
feasible in (fTTT) . shows that (ijf, . . . , I* n _ 1 ,I* l — 1) is feasible 
for INT G iv (A), thereby establishing dB-3b (and hence Claim 
(b)). 



It only remains to establish Claim (d). We first state the 
following facts with accompanying proofs. 

Fact 1: For B 1 ,B 2 C M, e G (Bi) + e G (B 2 ) < 
e G (Bi U B2) + e G (Bi n B 2 ). This holds by observing 
that e G {Bi U B 2 ) + e G {B 1 n B 2 ) - e G {B\) - e G (B 2 ) = 

El<i<3<m, ieBi\B 2 , j<£B 2 \B! Or ieB 2 \Bi : jeBi\B 2 &i — ^' 

Facf 2: For Bi, B 2 G £> vw'f/z Bi U B 2 ^ A, it holds that 
B\ U B2 fl«<^ -Si n B 2 are both in B. To see this, note first 
that 

E n = E^ + E^- E J * 

«eBins 2 



ieB 1 uB 



iGSi 



;gb 2 



e G (Bi) + e G (B 2 )- 



ieBiHB 2 



< e G (Si) + eG(S2)-e G (BinBa) 

< e G (SiUBj), by Fact 1. 

A1 »o, E Bi ub, % > e c(Bi U B 2 ), since B x U B 2 £ A is 
feasible in (fTTI i. The fact follows. 

Facf 5: For -B C .M, /ef D m (B) denote the total number 
of edges connecting to to all the vertices in B n A. Then, 
for B G B, if to G B then D m (B) > I* n , and if m £ B 
then D m (B) < 1^. To see this, consider first the case to G 
B G B. As {to} i B (since l* m > 0), we have B n A ^ 0. 
Since S G S, ^* =e G (5n4) + D m (B). Also, since 

£ H A ^ is feasible in (HTJ, J^ieBnA 1 * > e c{B n A). 
Subtracting the latter from the former gives 1^ < D m (B). 
The second assertion of the fact is proved similarly. 

Fact 4: The intersection of all Bs in B satisfying 1 ^ 
B, m G B, when nonempty, is also in B. The union of all Bs 
in B satisfying 1 £ B, to ^ B, when nonempty, is also in B. 

The first assertion in Fact 4 is obtained by observing that the 
union of all Bs in B with 1 ^ B, m G B, does not contain A, 
and by a repeated use of Fact 2. The second assertion would 
follow similarly by Fact 2 if the union of all Bs in B with 
1 G B, to ^ B, is strictly contained in A. Suppose not; then 
this union is exactly A. The ensuing contradiction can be seen, 
for instance, with B\ , B 2 as above with B\ U B 2 = A. Then 

d m = D m (A)=D m {B 1 UB 2 ) 

= D TO ((Bi\Ba)U(BinB2)U(B2\Bi)) 

= D m (Bi\B 2 ) + D m (Bi HB 2 ) + D m (B 2 \Si) 

= D TO (Bi) + I> m (B 2 )-D m (BinS2) 

< J m + J m - 1, b y Fact 3 and 1 e Bi fl B 2 



< 



< 



2L- 



1, 



by the assumption 7^ < |_- 



a contradiction. 

Finally, to prove Claim (d), let B' (resp. £?") represent the 
intersection (resp. union), when nonempty, in Fact 4. It suffices 
now to show that there exists v G B' n A (when B' ^ 0) such 
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that v B" and v connects to m; this follows from 

D m (B'\B") = D m {B') - D m (B' n B") 

= D m {B') - (D m (B") - D m {B"\B')) 

> C-(C-i). 

by Fact 3 and 1 e B"\B' 
= 1. 

Then, any B as in Claim (d)(a) must contain B' and hence the 
v above. On the other hand, any B as in Claim (d)(b) must 
be contained in B" and so cannot contain the v above. The 
cases B' = or B" = are handled trivially. 

(c) Let G uv = {M,E UV ) and suppose that T x U . . . U T k C 
E uv attain fx(A, G uv ). If E uv \{U k ; =l Ti\ contains at least one 
edge connecting (it, v), then {Ti,...,Tfc} is also a Steiner 
tree packing of G = (M,E), so that fi(A,G) > n{A,G uv ). 
Else, let T\, say, be the Steiner tree that contains an edge 
connecting u, v that emerged by splitting off («, m) and (v, m) 
of G = Then, {Ti\{(u, v)}} U {(u, m), (w, m)} is 

A-connected and hence contains a Steiner tree T{ for A in 
G = (jM, £") that corresponds to T\\ clearly, again fj,(A, G) > 
KA,G UV ). U 
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